4d0f14d7581422aae4d9c83ac1c6f74ad06910716b496487e18de3632bff2242

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_18f3340089ed2ece558e463e7487d63e_cryptolocker.exe
Size

58KB
MD5

18f3340089ed2ece558e463e7487d63e
SHA1

0fa2ad6b074012da7c00b291146545876ca5033c
SHA256

4d0f14d7581422aae4d9c83ac1c6f74ad06910716b496487e18de3632bff2242
SHA512

648808b452354ff19c0dec0fe1124df9ce574bcac2030abe379b9c0e2e97e1d343552205ce2da838e42435926fc7d2aa3064fc5e9a3251350e8b856243cb1613
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPt547/qGA:V6QFElP6n+gMQMOtEvwDpjyaLccVCbtA

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012232-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012232-12.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2672	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	2024-02-22_18f3340089ed2ece558e463e7487d63e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2672	2252	2024-02-22_18f3340089ed2ece558e463e7487d63e_cryptolocker.exe	29
PID 2252 wrote to memory of 2672	2252	2024-02-22_18f3340089ed2ece558e463e7487d63e_cryptolocker.exe	29
PID 2252 wrote to memory of 2672	2252	2024-02-22_18f3340089ed2ece558e463e7487d63e_cryptolocker.exe	29
PID 2252 wrote to memory of 2672	2252	2024-02-22_18f3340089ed2ece558e463e7487d63e_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-02-22_18f3340089ed2ece558e463e7487d63e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_18f3340089ed2ece558e463e7487d63e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
59KB

MD5
dab1cbb8cd2f0f91dd6aee45b4618dc9

SHA1
fe26e810a1c588925c8ecc72118e7701177594f7

SHA256
feec5fe1d7e542db78c4a53997ee2b8f38d30270eb37829e0fce64dd4d4cf2a8

SHA512
a8f642dd26b320fa3fbc4532f507a87211a03c3a09bfdc17c2e5778b7e392c184416f1f5ccdda070ef787e7ceb3f79055f05e90e1b456b56d19b2532c5d1cf57

Download Submit
memory/2252-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2252-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2252-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2672-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2672-16-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download